amazon prime does not work with pfsense (openvpn)
-
i have this problem with any provider that advertises streaming capabilities with pfsense.
i tried for a year. tried multiple providers that DO work with their app. but with pfsense i get your same message. i ended up setting rules for smart TV's to only utilises the WAN. none of the openvpn tunnels
hopefully i will learn something new in this thread...
-
And how is this anything to do with pfsense - NO SHIT the streamers are blocking vpn services.. Complain to your service you choose that the streamers are blocking them ;)
Pick a different vpn service - you understand its going to be a wack-a-mole game with the vpn services and the streaming services right ;)
Fire up your own vps in the country you want to look like your coming from to access the streaming service you want.. This has zero to do with pfsense, and nothing pfsense can do to help you with such a problem.
This should be moved to general and your subject should be amazon prime doesn't work with vpn service XYZ... I can tell you I watch amazon video almost every day.. Going to go finish off sneaky pete with the wife here in a few minutes. Works just FINE using pfsense..
-
Hi,
You could try port forwarding DNS requests from your smart TV to the dns server of your vpn provider.
If that doesn’t work try DNS over TLS (port 853) in unbound and use VPN-WAN as outbound if.Put in a floating rule to stop dns (853) exiting via WAN....
-
@johnpoz said in amazon prime does not work with pfsense (openvpn):
And how is this anything to do with pfsense - NO SHIT the streamers are blocking vpn services.. Complain to your service you choose that the streamers are blocking them ;)
Pick a different vpn service - you understand its going to be a wack-a-mole game with the vpn services and the streaming services right ;)
Fire up your own vps in the country you want to look like your coming from to access the streaming service you want.. This has zero to do with pfsense, and nothing pfsense can do to help you with such a problem.
This should be moved to general and your subject should be amazon prime doesn't work with vpn service XYZ... I can tell you I watch amazon video almost every day.. Going to go finish off sneaky pete with the wife here in a few minutes. Works just FINE using pfsense..
i disagree. its a configuration issue within Pfsense/ Openvpn somehow
if i setup 2 tunnels with difference providers (who state the service works) according to the leak tests are not leaking. but i get a message from amazon i am using a vpn using Pfsense. something still is not setup right.
as posted by the OP and myself. if you use their software from the VPN provider it does work. so that is not a provider issue, i still think it is configuration.
where would be the correct place to post this?
-
@DMZ-008 said in amazon prime does not work with pfsense (openvpn):
I am using google and cloudfare dns on pfsense. I tested for dns leak - I don't see my local ip or ISP DNS or my location
But the dns query is from a location..
If your in region A, and you query dns for streamer.com - you get back an IP 1.2.3.4 that is for your region A..
I you then hit that strteamer.com IP 1.2.3.4 from a vpn IP of 4.5.6.7 what do you think the streamer thinks?
If you route ALL your traffic, even your query of dns through the vpn - then your query for dns comes from IP 4.5.6.7, and your connection comes to streamer comes from 4.5.6.7
You need to make sure your dns query and your actual connection come from the same region.. And even then its still a wack-a-mole your playing with the streamer service and the vpn IPs, etc.
The streamer has zero clue to if your using pfsense or not.. So this is not a pfsense issue...
Streamers are all hosted off CDNs - and globally... But if your in region A, they don't give you an IP to hit the CDN in B.. IP from A hitting CDN in B is a clear sign of someone trying to circumvent their restrictions.
Here - perfect example
Here is query from NL for www.amazon.com, I have box over there I can route through..$ dig @8.8.8.8 www.amazon.com ; <<>> DiG 9.14.1 <<>> @8.8.8.8 www.amazon.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 14254 ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;www.amazon.com. IN A ;; ANSWER SECTION: www.amazon.com. 1257 IN CNAME www.cdn.amazon.com. www.cdn.amazon.com. 26 IN CNAME d3ag4hukkh62yn.cloudfront.net. d3ag4hukkh62yn.cloudfront.net. 59 IN A 52.222.154.143 ;; Query time: 136 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Sun May 19 07:04:40 Central Daylight Time 2019 ;; MSG SIZE rcvd: 124
Where is that 55.222 IP located..
Now do a dns query from my actual IP.
$ dig @8.8.8.8 www.amazon.com ; <<>> DiG 9.14.1 <<>> @8.8.8.8 www.amazon.com ; (1 server found) ;; global options: +cmd ;; Got answer: ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 57579 ;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1 ;; OPT PSEUDOSECTION: ; EDNS: version: 0, flags:; udp: 512 ;; QUESTION SECTION: ;www.amazon.com. IN A ;; ANSWER SECTION: www.amazon.com. 1558 IN CNAME www.cdn.amazon.com. www.cdn.amazon.com. 46 IN CNAME d3ag4hukkh62yn.cloudfront.net. d3ag4hukkh62yn.cloudfront.net. 59 IN A 99.84.250.155 ;; Query time: 35 msec ;; SERVER: 8.8.8.8#53(8.8.8.8) ;; WHEN: Sun May 19 07:05:15 Central Daylight Time 2019 ;; MSG SIZE rcvd: 124
Where do you think that 99.84 is actually located?
Can tell you that if ping IP that is 55, its a long way from my actual location
Pinging 52.222.154.143 with 32 bytes of data: Reply from 52.222.154.143: bytes=32 time=126ms TTL=237 Reply from 52.222.154.143: bytes=32 time=118ms TTL=237 Reply from 52.222.154.143: bytes=32 time=122ms TTL=237
If I ping the 99 address is a lot closer
Pinging 99.84.250.155 with 32 bytes of data: Reply from 99.84.250.155: bytes=32 time=12ms TTL=242 Reply from 99.84.250.155: bytes=32 time=13ms TTL=242 Reply from 99.84.250.155: bytes=32 time=9ms TTL=242
If I do a traceroute from my actual location I can tell its for sure in EU somewhere..
10 11 ms 11 ms 11 ms chi-b21-link.telia.net [213.248.90.181] 11 118 ms 118 ms 117 ms nyk-bb4-link.telia.net [62.115.137.58] 12 125 ms 124 ms 132 ms ldn-bb3-link.telia.net [62.115.113.21] 13 116 ms 125 ms 117 ms prs-bb3-link.telia.net [62.115.134.92]
You can see where it leaves the states and goes over to london and then look like that 62.115 address "prs-bb3-link.telia.net"
Is in Helsinki, Finland...
If you do a PTR on those IPs you can work out where in the world they are located..
server-99-84-250-155.ord50.r.cloudfront.net [99.84.250.155]
See the ord50, that would mean its in Chicago area - which is me ;)
server-52-222-154-143.fra53.r.cloudfront.net [52.222.154.143]
See that fra53, that would tell me its in Frankfort, DE... Which would make sense if I was asking for where to go to amazon.com from EU..
-
How do you connect to your VPN providers Server ? Hostname or IP ?
My provider offers hostnames. E.g. country.provider.com or city.provider.com
It will then distribute (or maybe load balance) incoming connections and resolve to a specific IP.If a streaming provider had blacklisted a specific IP you may get the VPN warning....
I suggest the following. Connect to the VPN provider via desktop app. In pfsense check which destination ip the tunnel is using.
Configure the ovpn client in pfsense to use the same IP and test.
-
@gcu_greyarea Hi, my vpn provider does not share the DNS servers. They asked to use google dns instead.. which I am already using
-
@DMZ-008 said in amazon prime does not work with pfsense (openvpn):
They asked to use google dns instead.. which I am already using
And you need to make sure the google servers are actually queried via the vpn connection - or your going to get different CDN locations for the vpn region and your location.. Went into great detail on this in my previous post.
-
@bcruze Hi, I agree. This is a pfsense / openvpn configuration issue rather than a vpn provider issue. Something seems to be leaking from pfsense/ openvpn which the dns leak tests are not able to detect but amazon is.
-
@johnpoz Hi..In DNS Resolver, network interface selected are LAN and local host. The outward interface = VPN_WAN. The DNS traffic is going through the VPN tunnel.
-
@gcu_greyarea Hi..I am using server hostname.
sorry..how do I check the destination ip the tunnel is using.
-
If the dns traffic is going through the vpn, and the actual traffic is going through the vpn.. And your being blocked by the streamer.. How do you think it could be a pfsense issue.
But your streamer complains that your using a vpn - how and the hell do you think this has something to do with pfsense?
-
@johnpoz I tried to both ways (dns traffic through tunnel and w/o) ..the end result is the same. I seek opinion from the forum on what pfsense configuration has worked for others.
-
There is no magic here... If all your traffic both dns and actual traffic is going through the vpn.. And the streamer says your using a VPN... Then what do you think you could do on pfsense to circumvent that?
Pfsense is a router/firewall distro... Not sure why the community should help you use the tool to circumvent some streamers geoip restriction policy in the first place to be honest.
Contact your vpn service - since they seem to be in the circumvention business.
Here simple google finds this.
Amazon Prime Video streams great on select US servers. These change occasionally, so we recommend hitting up ExpressVPN’s 24-hour live chat support to ask which servers currently work with Prime Video
As previous stated this is always going to be a wack-a-mole game..
-
@DMZ-008 said in amazon prime does not work with pfsense (openvpn):
sorry..how do I check the destination ip the tunnel is using.
Have a look at the state table. "Show states" on the pfsense Dashboard.
You can then filter by Interface or search for IP Adresses/Ports.You can see that there are no DNS Requests on the WAN interface, but going through the VPN Tunnel instead (Port 853)
-
Well when I go home in two days I think I will have it working..the android Sony TV is the final test
I read a command used by another provider and it works when I remote into my Mac and use the chrome browser
Read this page : https://openvpn.net/community-resources/pushing-dhcp-options-to-clients/
For the record it has Never worked in chrome before making this change to dns in the advanced configuration window
EDIT.
it still does not work. Amazon Prime and Netflix both detect a VPN. so frustrating and makes NO sense
-
What if we could just allow the amazon server to bypass the vpn, like we could do with selected clients?
I have 1 laptop and 2 tablets that bypasses my vpn. I created a firewall rule to bypass the traffic on those devices though the WAN gateway and made a alias list of those devices.
Is there a way to do that with Prime?
I used packet capture on my device and looks like these are the ip's used by prime, did an arin search and found the net range, which is huge.(54.176.0.0-54.191.255.255) -
@edwardnizz you can check out this video https://www.youtube.com/watch?v=cX1_f-KRJhY
-
I just got my pfSense/NordVPN client setup. I'm routing ALL DNS traffic over the VPN, which I think solves the DNS leak issue. Only selected/tagged/aliased (VPN_HOST) LAN hosts have other TCP4+UDP4 traffic routed through the VPN.
I have verified that no host can access even https://amazon.com until it become a VPN_HOST.
In other words, if the DNS used is somehow whack (sorry I'm missing the lexicon to describe) compared to the WAN IP, amazon is confused.
-
It has nothing to do with Pfsense. It is the server you are connected with ExpressVPN. Go ask ExpressVPN which is a working server connection.
Sometimes the server you get connected is okey and sometimes not.
I had the same exact experience with ExpressVPN. it takes several days to get a good connection and the problem is always on their end. If you ask customer service they will tell you there is nothing wrong on their end which make it so confusing.
Trust me I had the same dilemma. just be patient and wait until those engineers fix it.
-
I seriously doubt this is a pfsense issue, I have this problem and my dns is always routed through cloudflare. I enable vpn and amazon blocks my firestick. I disable vpn and they allow it. My dns is exactly the same in both situations.
The issue is with the vpn providers servers being blocked
https://www.reddit.com/r/nordvpn/comments/bgkw0s/amazon_prime_has_started_blocking_nordvpn_servers/?utm_source=amp&utm_medium=&utm_content=comments_view_all
-
I think it might be possible that it has something to do with pfSense, as my current work-around is to restart the DNS Resolver service. That said, I believe the root issue is that I don't have my DNS configured correctly for what I'm trying to do.
What I'm trying to do is route all traffic (including DNS) from a specific host through a VPN. And I thought I'd like to route all network DNS traffic through the VPN as well (to plug DNS leaks), but now I can see that may cause some issues with some hosts. I followed followed this guide to get as far as I have.
The specific host (it's a Linux VM) is mostly working, but DNS is leaking:
ubuntu@ubuntu-18-04:~$ ./dnsleaktest.sh Your IP: 208.84.155.45 [United States of America AS46562 Total Server Solutions L.L.C.] You use 9 DNS servers: 24.93.50.4 [United States of America AS11427 Time Warner Cable Internet LLC] 24.93.50.5 [United States of America AS11427 Time Warner Cable Internet LLC] 24.93.50.7 [United States of America AS11427 Time Warner Cable Internet LLC] 24.93.50.9 [United States of America AS11427 Time Warner Cable Internet LLC] 24.93.50.12 [United States of America AS11427 Time Warner Cable Internet LLC] 24.93.50.14 [United States of America AS11427 Time Warner Cable Internet LLC] 24.93.50.15 [United States of America AS11427 Time Warner Cable Internet LLC] 24.175.34.39 [United States of America AS11427 Time Warner Cable Internet LLC] 103.86.96.100 [Australia AS36351 SoftLayer Technologies Inc.] Conclusion: DNS may be leaking.
And not surprisingly, DNS is leaking for other non VPN LAN clients.
The key configuration points are:
- Services->DNS Resolver->General Settings->Outgoing Network Interfaces: [WAN, VPN_INT]
- Services->DNS Resolver->General Settings->DNS Query Forwarding: [Enable Forwarding Mode]
- System->General Setup->DNS Server Settings->DNS Servers: [VPN DNS1, VPN DNS2]
For item 1 above, I tried to configure without the WAN interface, but that basically shut down all DNS capabilities for clients not using the VPN.
When I look at Status->DNS Resolver, I see my VPN DNS server IP's, and additionally 2 DNS IP's that I assume are from my ISP; not sure how the ISP DNS servers get configured in, but maybe that's the problem?
Thanks!
-
If you want to forward only to specific NS, then turn off getting dns from ISP.
-
I think that is done by setting Services->DNS Resolver->General Settings->DNS Server Override:[OFF]. And then probably Services->DNS Resolver->General Settings->Outgoing Network Interfaces: [VPN_INT] (i.e. VPN only)
Doing that, I was able to get Amazon Prime to work (Roku app), but it seemed slow and wonky (thumbnails didn't display), but whatever I blindly selected did play. I quit the app, and started it again and it seemed okay. However, still on Roku, running the Sling TV and apps that depend on it (ESPN) do not work. Also, connecting to https://www.amazon.com from a PC did not work.
Put the DNS Server Override back on and all is normal. I'm stumped. Any other ideas?
-
I think I figured how to make this work: I configured the DHCP Static mapping for the Roku device to use googles DNS and all is well ... so far.
-
it didn't take long to find something that doesn't work ... I forgot to check if amazon works, and it does not.
That might be a good thing really, but still, I'd rather have it work and it's probably not the only web site that will be an issue.
I don't mind setting DHCP Static DNS settings for a few devices, but more than a few is ugly, and setting google DNS Servers for all clients defeats the purpose.
There must be another way.
-
Just logging issues here; another thing that this DNS issue causes is that NFL.com Fantasy Football Game Center does not work.